<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<Events>
  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
      <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/>
      <EventID>4624</EventID>
      <Version>2</Version>
      <Level>0</Level>
      <Task>12544</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8020000000000000</Keywords>
      <TimeCreated SystemTime="2020-06-05T16:12:02.4523553Z"/>
      <EventRecordID>1599</EventRecordID>
      <Correlation ActivityID="{0a1f366b-3b54-0000-0d37-1f0a543bd601}"/>
      <Execution ProcessID="668" ThreadID="508"/>
      <Channel>Security</Channel>
      <Computer>DESKTOP-4AR7BIA</Computer>
      <Security/>
    </System>
    <EventData>
      <Data Name="SubjectUserSid">S-1-5-18</Data>
      <Data Name="SubjectUserName">DESKTOP-4AR7BIA$</Data>
      <Data Name="SubjectDomainName">WORKGROUP</Data>
      <Data Name="SubjectLogonId">0x3e7</Data>
      <Data Name="TargetUserSid">S-1-5-18</Data>
      <Data Name="TargetUserName">SYSTEM</Data>
      <Data Name="TargetDomainName">NT AUTHORITY</Data>
      <Data Name="TargetLogonId">0x3e7</Data>
      <Data Name="LogonType">5</Data>
      <Data Name="LogonProcessName">Advapi  </Data>
      <Data Name="AuthenticationPackageName">Negotiate</Data>
      <Data Name="WorkstationName">-</Data>
      <Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
      <Data Name="TransmittedServices">-</Data>
      <Data Name="LmPackageName">-</Data>
      <Data Name="KeyLength">0</Data>
      <Data Name="ProcessId">0x284</Data>
      <Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
      <Data Name="IpAddress">-</Data>
      <Data Name="IpPort">-</Data>
      <Data Name="ImpersonationLevel">%%1833</Data>
      <Data Name="RestrictedAdminMode">-</Data>
      <Data Name="TargetOutboundUserName">-</Data>
      <Data Name="TargetOutboundDomainName">-</Data>
      <Data Name="VirtualAccount">%%1843</Data>
      <Data Name="TargetLinkedLogonId">0x0</Data>
      <Data Name="ElevatedToken">%%1842</Data>
    </EventData>
  </Event>
</Events>
